Better named encryption flags, start triaging.

Create distinct flags for encryption aware, unaware, and both, and
name them like the other MATCH_ flags.

Start adding logic to help triage all system internal callers to
verify that they've done their homework and thought about how to
handle apps while locked.  Call sites in the system should either
ask for explicit matching behavior, or explicitly use the DEFAULT
match flag to indicate that they've been triaged to use the
default state-based matching.

Bug: 26250295
Change-Id: I86214e5c4f71a6dc72f06930800388713aecd107